In this talk, we will introduce one of Mitsubishi's PLC network protocols, Melsoft. Melsoft is usually the default protocol of Mitsubishi PLCs. In September 2023, TMRTEK's products took a test in ACW SOUTH, and got the score of 100% detection cover rate. We achieve this by inspecting deeply into OT protocols.

By delving into the command level, we could carry out the most detailed of behavior analysis in OT protocols. We will share our experience of OT network behavior analysis by using LSTM (Long Short-Term Memory). By learning from past data, LSTM could predict the data value of the next time slot. Therefore, it is a suitable tool to find out the network traffic which is different from the normal pattern. LSTM could be used as a tool of discovering anomaly of connection number, anomaly of transmission amount, and abnormal OT protocol commands.